CVE-2024-12667: InvoicePlane view session expiration
A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12667?
CVE-2024-12667 is classified as problematic due to its potential impact on session expiration.
How do I fix CVE-2024-12667?
To fix CVE-2024-12667, upgrade InvoicePlane to the latest version beyond 1.6.1.
What is the attack vector for CVE-2024-12667?
CVE-2024-12667 can be exploited remotely, affecting the functionality of the file /invoices/view.
What versions of InvoicePlane are affected by CVE-2024-12667?
InvoicePlane versions up to and including 1.6.1 are affected by CVE-2024-12667.
What are the consequences of CVE-2024-12667 exploitation?
Exploitation of CVE-2024-12667 leads to session expiration, potentially disrupting user sessions.